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It has been suggested that the ability of quantum mechanics to allow secure distribution of secret 
key together with its inability to allow bit commitment or communicate superluminally might be 
sufficient to imply the rest of quantum mechanics. I argue using a toy theory as a counterexample 
that this is not the case. I further discuss whether an additional axiom (key storage) brings back 
the quantum nature of the theory. 



One of the great desires of those who study both quan- 
tum information theory and quantum foundations has 
been to find simple information-theoretic axioms suffi- 
cient to imply all the rest of quantum mechanics Q. To 
this end it has been suggested (private communication 
from Fuchs and Brassard to Bub, reported in [2j and cf. 
HQ) that the existence of unconditionally secure cryp- 
tographic key distribution (of the sort granted by quan- 
tum mechanics 0,E|), together with the impossibility of 
secure bit commitment (also a feature of quantum me- 
chanics might comprise just such a sufficient set. 
This is appealing as these two cryptographic primitives 
capture two of the key properties of quantum mechan- 
ics: Quantum key distribution is built on the idea that 
information gathering causes a necessary disturbance to 
quantum systems, while the bit commitment no-go the- 
orem depends on an entanglement-based attack. More 
recently, this question has been rephrased slightly, and 
an axiom added by Clifton, Bub and Halvorson (CBH) 
0. Their axioms are: 

• No broadcasting of arbitrary information — In 
quantum mechanics, noncommuting density matri- 
ces cannot be cloned or even distributed in such a 
way that all marginal density matrices are correct. 

• No unconditionally secure bit commitment. 

• No superluminal communication transfer, i.e. a 
measurement on one system does not affect other 
systems. 

In this paper I argue that these axioms are not sufficient 
to imply quantum mechanics. To make the argument, I 
propose an alternate toy theory of physics which satisfies 
these axioms but which quite obviously will not imply 
quantum mechanics. This result is in direct contradic- 
tion to Clifton, Bub, and Halvorson's, whose result seems 
to depend on the additional assumption that a physical 
theory must be a C* algebra. It is unclear at this time 
just how much that additional assumption brings into the 
discussion. 



LOCKBOX MODELS 

I will consider a class of toy models whose basic unit of 
matter is the lockbox. A lockbox in general is an object 
akin to a physical box that can contain bit strings and 
cannot be opened except when the correct conditions ex- 
ist to open the box. Depending on the model the box 
might be opened with a combination, a physical key, or 
something else. A lockbox may also perform other func- 
tions on the data within it depending on various inputs. 
Such boxes need not be allowed by physics, but instead 
are the building block of toy theories. 

For example, consider a lockbox with a combination 
lock, that can contain a bit value b. The value cannot 
be read out of the lockbox except if a particular string of 
bits C — the combination — is presented to it. The bit b 
and combination C are chosen by the lockbox's creator at 
the time of its creation. If the lockbox is presented with 
an incorrect combination, the bit value is destroyed. 

It can be helpful to think of such a lockbox as a physical 
box, that one could made of brass or steel, but it must 
be stressed that this can only be an approximation. The 
bit value in the lockbox by definition cannot be read out 
by any means other than using the correct combination, 
whereas a brass or steel box can always be drilled or 
blown open with explosives if enough effort is expended. 

A true lockbox cannot exist in classical mechanics. It 
is often said that one way in which quantum mechan- 
ics differs from classical mechanics is that it cannot be 
represented by a local hidden variable theory. This state- 
ment hides a common oversight about classical mechan- 
ics. Classical mechanics also is not correctly represented 
by a local hidden variable theory, but by a local unhidden 
variable theory — in principle every possible property of a 
classical system can be measured perfectly |ll| whereas 
the contents of a lockbox are unconditionally protected. 
Our example lockbox also differs from both classical and 
quantum theory in that its behavior when the wrong 
combination is applied is irreversible — the bit value is 
destroyed and cannot be recovered 01 ■ Thus a lockbox 
explicitly mimics the quantum property that unknown 
nonorthogonal states cannot be cloned (cop ied) 0, Q] 
or even measured without disturbance . A lockbox 
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also cannot be broadcast, since in order for the copies to 
have the correct marginal behavior they each must have 
the right combination, and there is no way of reliably 
determining the combination. 

It is straightforward to implement secure key distribu- 
tion using lockboxes of this type. As in quantum key 
distribution, two parties (Alice and Bob) are assumed to 
share an ordinary classical channel, which is unjammable 
and authenticated, and to have the ability to prepare 
systems, in this case lockboxes, and send them, to each 
other. Eve, the eavesdropper, is assumed to have full 
physical access to the lockboxes while they are in tran- 
sit, meaning she can manipulate them at will, subject 
only to the constraints imposed by the physical theory. 
In particular, she is unable to reliably open the boxes if 
she does not know C. 

The protocol is as in Bennett and Brassard's 1984 
quantum key distribution paper [| (BB84), but simpli- 
fied: Alice picks N random bits and prepares N lock- 
boxes with random combinations. She sends the lock- 
boxes to Bob. Once Bob has received them, he tells Alice 
they have arrived and then she sends the combinations to 
him over the classical channel. He can now open the lock- 
boxes and extract the bits. They then test some number 
m of the bits to see if they are what Alice put into the 
lockboxes in the first place. Since Eve would likely have 
destroyed the contents of any lockbox she tried to open, 
the correctness of the tested bits assures Alice and Bob 
that Eve could not have opened very many of the lock- 
boxes. They can then do privacy amplification and 
reduce Eve's information to much less than one bit. 

On the other hand, lockboxes as proposed fail to ex- 
clude the possibility of bit commitment. In fact, they 
essentially are the embodiment of the simplest possible 
form of bit commitment. Alice puts a bit in the lockbox 
and gives it to Bob, who cannot open it. She opens the 
commitment by telling him C . Alice cannot cheat using 
an EPR attack as in 0, because the physics does not 
allow for entanglement at all. Clearly we need a more 
sophisticated lockbox. 

One simple modification to the lockboxes that appears 
to eliminate bit commitment fails, but the reason is in- 
teresting: Suppose every lockbox is given a second com- 
bination which instead of revealing b reveals the com- 
plement b — call this C (note this is not necessarily the 
bitwise NOT of C). Now in the above bit-commitment 
scheme Bob has no way of knowing if Alice told him the 
real combination C or the complementary combination 
C. Since Alice can open the commitment to either b or 
b this is no commitment at all. It would seem evident 
that in any bit-commitment protocol such a lockbox is 
useless, since it essentially a bit controlled utterly by its 
creator. The creator can cause it to become either a zero 
or a one and can prevent anyone else from learning even 
this noninformation until such time as either C or C is 
announced. But, as pointed out by Aram Harrow |l9| . 



by using more than one lockbox, bit commitment can be 
achieved. Alice prepares many lockboxes, all with differ- 
ent combinations. To commit to a zero, she makes the 
numerically lower combination open the bit as a zero for 
all of them. To commit to a one, she makes it so the 
numerically higher combination opens the bit as a zero. 
She gives all the boxes to Bob. To open the commitment, 
Alice tells Bob all the combinations. Bob can check her 
truthfulness about the commitments and combinations 
by opening each box randomly using either its lower or 
higher combination. 

It is the ordering property of classical numbers that 
allows this version of bit commitment to work, and I 
conjecture this will be the case with any scheme based 
on classical combinations securing lockboxes. However, 
this problem suggests its own solution: Instead of a clas- 
sical combination, what is needed are boxes secured by 
physical keys. If a key has a button on it which causes 
the secured bit to flip without having any physically de- 
tectable effect on either the key or the lockbox, it is im- 
mune to the ordering to which classical combinations are 
subjected. 



A LOCKBOX THEORY SATISFYING THE 
AXIOMS 

Such a lockbox-key pair still is not able to avoid bit 
commitment without further modification. The asym- 
metry between boxes and keys could lead to a protocol 
where Bob gets to hold onto the keys and Alice holds 
the boxes, preventing Alice from changing the concealed 
bits. So we will add buttons to the lockboxes as well, 
which also flip the bit inside. Notice that now the keys 
and boxes are interchangeable — someone in possession of 
either one can flip the bit, and both are needed to reveal 
the bit. So we may as well consider them as symmetric 
lockbox pairs. 

To formalize a lockbox pair (LBP) we write its state 
as a vector 

B = (b,s,xi,x 2 ,pi,P2) (1) 

where b is the value stored in the pair, s is a classical 
label unique to each pair, x\ and x-i are the position co- 
ordinates of each box of the pair and p\, p 2 are their 
momenta. The x's and p's transform as usual classical 
coordinates. This actually encompasses quite a bit, for 
in a cryptographic setting one cannot simply talk about 
an operator which changes the momentum of a particle, 
one needs to make clear that only the party in possession 
of a particle can perform such an operator. In the fol- 
lowing we make this explicit with respect to the position 
variables but omit the momenta. It is to be understood 
that the boxes can be moved from place to place with 
some finite velocity as classical objects. 
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There are two types of measurements allowed on an 
LBP. First is the # operator, which reads out the serial 
number of the pair: 

#x(B) = s(5 x ^ Xl + 5 XjX2 - 5 XuX2 ) (2) 

An important feature is that no two pairs have the same 
serial number, nor can anyone create another pair with a 
given serial number. This, perhaps unappealing, feature 
can be resolved most simply by having all the pairs cre- 
ated with their unique serial numbers at the time of the 
creation of the universe, after which they are conserved 
|l7j |. This is not so unusual in that traditional physi- 
cal theories have finite conserved resources like angular 
momentum and energy. 

The other measurement is the value operator V which 
reads out the value b contained in the pair: 

V X (B) = (l + b)6 (3) 

Each operator has an x subscript, representing where 
the party performing the operation is located. The # 
operation can be performed by a party possessing one or 
both of the boxes in a pair, the V operator only works if 
the party is colocated with both boxes. Note that V is 
a three-outcome measurement, resulting in a zero if the 
boxes and measurer are not all together, and in 1 + b if 
they are. 

There is also the flip operation, which is not a mea- 
surement, but rather a transformation on the state B. It 
flips the bit value of the state when it is applied in the 
location of either or both halves of the pair: 

F x (B)^((b®6 ),s,x 1 ,x 2 ) (4) 

There is a trivial no-go theorem for broadcasting for 
LBPs. No two LBPs have the same serial numbers, so no 
copy can have the right properties. 

LBPs can be used for key distribution: Alice puts a bit 
into the pair, sends one of the boxes to Bob, who tells 
her when it has been received. Only then does she send 
the other box of the pair, allowing Bob to reveal the bit. 
Eve cannot substitute a box of her own due to the serial 
numbers unique to each LBP. 

Bit commitment is excluded by the following argu- 
ment. For each LBP in a protocol, during the committed 
phase either Bob has both boxes or else Alice has at least 
one of them. If Bob has both, he can read the bit. If Alice 
has at least one of the boxes, she can change the bit. 

Furthermore, the LBPs are a purely local theory. The 
formal rules mask this somewhat, as it appears that the 
flip operator allows changing the bit value at a distance, 
but since the bit can only be read once the boxes are 
brought together this isn't a problem. Each box merely 
has to remember locally whether or not to flip the bit 
when brought together. The LBP theory is equivalent to 



the following, where each box is individually represented 
by a vector: 

Bi = (6i,s,xi), B 2 = {b 2 ,s,x 2 ) (5) 

# X (B<) = s6 XtXi (6) 

The value operator now acts on pairs of boxes: 

V^B^Bj) = [1 + (b, (B bj)]5^ Xi 6 x>Xj (7) 

and the flip operator is 

F x (Bi) -> (k® 8 XtXi ,s, Xi ) . (8) 

This is clearly a local hidden variable theory describ- 
ing LBPs. So we are faced with a theory that is compat- 
ible with all the axioms but which is incompatible with 
quantum mechanics (and therefore cannot imply quan- 
tum mechanics). 

ANOTHER AXIOM AND MORE MODELS 

This leaves us with the question of what additional 
axioms are needed to imply quantum mechanics. One 
suggestion, due to Jeffrey Bub , is the additional abil- 
ity of quantum mechanics to perform key storage. Key 
storage is similar to key distribution but the key is dis- 
tributed across time rather than space. Alice and Bob do 
some quantum communication, then open their labs up 
to Eve, who can look around all she likes, and can even 
measure, modify, or replace any quantum states she finds 
stored there. After some period of time Alice and Bob 
communicate classically, and are still able to generate se- 
cure key. (Eve cannot be allowed to actually play with 
their equipment while she is there. If she replaces ev- 
erything in the labs with her own Trojan lab racks then 
there isn't much of anything Alice and Bob can trust. 
Some work on such Trojans has been done by Mayers 
2fJ.) The quantum key distribution protocol of Ekert 
21| which uses EPR pairs rather than the unentangled 
states of BB84 is also a key storage protocol. The pro- 
tocol is for Alice and Bob to first share EPR pairs and 
later, when they wish to create key, measure them in 
random bases, which they only then agree upon over a 
non-secret classical channel. By revealing the results of 
some of the measurements they can ensure that Eve has 
not tampered with the EPR pairs. 

Such a protocol appears to be impossible with LBPs. 
Whatever Alice and Bob do, once they leave Eve alone 
with the lockboxes Eve could just read out their contents 
using the value operator and by Alice and Bob would be 
none the wiser. However, key storage using EPR pairs, 
as well as all forms of key distribution, relies on a pecu- 
liar assumption. These protocols all depend on the exis- 
tence of an authenticated public channel between Alice 
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and Bob to prevent a man-in-the-middle attack. Such an 
assumption is anathema to a cryptographer, especially 
when there exist provably secure classical authentication 
protocols [2^|. These all rely on Alice and Bob having 
a shared secret, which in a sense obviates key distribu- 
tion, since this secret is a key. The difference is that 
the shared secret can be very small, indeed a constant 
amount of key can authenticate any sized classical mes- 
sage. So more correctly quantum key distribution and 
storage protocols should be thought of as expanding the 
existing key rather than generating one from nothing. 

With that in mind, we can find protocols for key stor- 
age using a slightly modified form of LBP. Consider an 
LBP which is "set and read-once" — one can initially store 
a bit value in the pair after which the value operator can 
be applied only once. After that it always returns null. 
These can be used to store secrets as follows: Alice makes 
many LBPs, the values of which are the secret. She keeps 
these entirely in her own lab. Bob does likewise. What 
they must remember even when Even is granted access 
to their labs are the serial numbers of some subset of the 
pairs. If Eve were to read the values of those pairs the 
value operator would cease to function on them, a condi- 
tion which Alice and Bob would notice upon their return. 
They can therefore estimate how many pairs Eve might 
have measured, and then perform traditional privacy am- 
plification to increase the security of the bits encoded by 
the remaining LBPs. Oddly, the extra information Alice 
and Bob need to keep secret from Eve during her intru- 
sion need not be a shared secret between them, but only 
private secrets about the LBPs in their own labs. 

Another protocol would be for Alice and Bob to re- 
member the serial numbers of all the pairs. If Eve ap- 
plies the value operator to any of the pairs Alice and Bob 
will notice. This is really a slightly different case than we 
have discussed before — the amount of information Alice 
and Bob need to remember is much larger than before, 
but does not need to be kept secret, only secure from 
alteration. 

Each of these cases still differs from the quantum case 
using EPR pairs in an interesting way: With the EPR 
pairs the needed small authentication key could be shared 
at the time of the key generation (through a low-capacity 
secure channel, or in person for example) — Alice and Bob 
need only be sure they are talking to each other. In 
the LBP schemes they need to have remembered some- 
thing about the actual boxes. This is a subtle but in- 
escapable difference: If neither Alice nor Bob remembers 
anything about the LBPs themselves nothing can prevent 
Eve from replacing them all with her own, whose contents 
she knows but which otherwise would appear to Alice and 
Bob to obey all the rules of their protocol. The EPR pairs 
provide, due to their odd nonlocal nature, a way around 
this problem. In a quantum-mechanical world only true 
EPR pairs can pass all the tomographic tests [23J that 
Alice and Bob could perform knowing only that they are 



supposed to be EPR pairs. Once assured that they really 
share EPR pairs, Alice and Bob can generate secure key. 

This suggests a third kind of toy model, which I call the 
random correlated pair (RCP). Like the LBP these come 
in pairs, each member having an identical serial number, 
distinct from that of all other RCPs, and each having 
an enclosed bit value. RCPs can, however, be opened 
revealing their bit value even when the two members of 
a pair are separated, and each member has the same bit 
value as its twin. RCPs are read-once, and the bit value 
of an RCP is unknown to anyone before either box of 
a pair is read. These behave like like EPR pairs with 
respect to key storage, in that Alice and Bob can easily 
check if what they have is really an RCP pair — merely 
having a pair with matching serial numbers is sufficient to 
ensure Eve has not tampered with them, as she cannot 
control the bit value in a pair, nor read the bit value 
without using up at least one member of the pair. 

DISCUSSION 

I have been careful to consider both the no broadcast- 
ing and the key distribution properties of all these toy 
models. This is because there is a trivial theory that sat- 
isfies the other axioms. Namely, a theory with only one 
type of element, a box with a unique serial number and 
no bit value inside at all. Such a box cannot be cloned or 
broadcast, due to the serial number, cannot communicate 
super luminally, and cannot be used for bit commitment. 
On the other hand, it is also useless for distributing key 
thus I maintain that key distribution is a necessary axiom 
to make this question meaningful. 

One objection which has been raised is that lock- 
boxes don't capture the true flavor of an information- 
disturbance tradeoff — a quantum measurement on non- 
orthogonal states can reveal partial information, while 
the lockboxes are all or nothing. In fact, Brassard and 
Fuchs Q specifically mentioned lockboxes as something 
which they did not want used to refute their conjecture. 
Leaving aside the issue of whether it is fair to directly 
exclude the embodiment of one's axioms, I believe this is 
not a real failing of the lockboxes. It should be possible 
to modify them to reveal varying amounts of information 
under certain conditions without affecting their ability to 
satisfy the CBH axioms. I expect that proofs using such 
systems will likely be more difficult, for relatively little 
gain in insight. 

All of the toy models herein that satisfy the CBH ax- 
ioms employ unique serial numbers, primarily as a way 
of ensuring no broadcast (though this is also useful in ex- 
cluding some bit commitment strategies which may be in- 
secure, but for which this is difficult to prove). The orig- 
inal combination lockboxes have the no broadcast prop- 
erty for a different reason, but fail to avoid bit commit- 
ment. It would appear that something deep comes from 
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the distinguishability implicit in serial numbers. How- 
ever, recently Spekkens |2 1| has invented another toy 
model which appears to satisfy all the CBH axioms (as 
well as key distribution) and does not have a distinguisha- 
bility property. Like the lockbox models, it is based on 
certain information being assuredly inaccessible to any 
observer, and is a local hidden variable theory. Unlike 
them, the Spekkens theory has a composability lockbox 
models lack. His model defines what happens in measure- 
ment on multiple systems in a nontrivial way, whereas all 
the models presented in this note are explicitly noninter- 
acting. This makes the Spekkens model much more like 
quantum mechanics than any lockbox model without be- 
ing quantum mechanics. It will be the subject of future 
work to flesh out the connections between these different 
kinds of models. Understanding the differences may lead 
us to a better understanding of just what, in addition to 
the CBH axioms, is needed to get us to a theory with the 
full richness of quantum mechanics. 
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